Grant a role, which mints a key

POST

/provision/databases/{id}/roles/{roleId}/grant

The holder is a label (ci-runner, ada's laptop), not an account.
What comes back is a passwordless session and, exactly once, its
secret: the holder signs grants naming this role and its id, and the
session's ceiling is the role's scope at each request. Revoke one at
DELETE …/passwordless/{sessionId}. An api key is bound to a role at
POST …/keys with role.

Capability: access:write (area resource, on the database).

Request

Path Params

Body Params application/jsonRequired

Examples

Responses

🟢201

application/json

Granted. The one time the secret is legible.

Bodyapplication/json

🟠404

🔴502

🔴503

🟠400ValidationError

🟠401KlockUnauthorized

🟠403CapabilityMissing

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.prod-orm.io/provision/databases//roles//grant' \
--header 'Content-Type: application/json' \
--data '{
    "label": "string",
    "expiresAt": "2019-08-24T14:15:22.123Z",
    "auth": "secret",
    "teamId": "a4ede8ba-7c0a-4485-8763-cbd9b282fbec"
}'

Response Example

201 - Example 1

{
    "grant": {
        "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
        "role": "string",
        "entId": "string",
        "scope": {
            "ops": [
                "read"
            ],
            "tables": [
                "string"
            ],
            "columns": {
                "property1": [
                    "string"
                ],
                "property2": [
                    "string"
                ]
            }
        },
        "label": "string",
        "auth": "secret",
        "principal": "string",
        "tlsFingerprint": "string",
        "poolId": 0,
        "lastUsedAt": "2019-08-24T14:15:22.123Z",
        "expiresAt": "2019-08-24T14:15:22.123Z",
        "revokedAt": "2019-08-24T14:15:22.123Z",
        "createdAt": "2019-08-24T14:15:22.123Z"
    },
    "secret": "string",
    "secretSeenOnce": true,
    "client": {
        "sessionId": "f6567dd8-e069-418e-8893-7d22fcf12459",
        "role": "string",
        "entId": "d715fdbf-166d-45cf-86f0-644c00a79914",
        "windowSeconds": 30
    },
    "tls": {
        "ca": "string",
        "cert": "string",
        "key": "string"
    },
    "kerberos": {
        "realm": "string",
        "principal": "string",
        "service": "string",
        "kdc": "string",
        "keytab": "string"
    }
}

Modified at 2026-10-05 14:01:12

Delete a role, and revoke every key granted it

Who holds a role